CS 259D One-Class Training for Masquerade Detection

作者:Leo

  • 背景知识与启发
  • Schonlau 数据集
  • 机器学习方法
    • 朴素贝叶斯分类器
    • 单分类 SVM
  • 局限性
  • 参考资料

背景知识与启发

  • 用户行为建模
  • 检测异常行为
  • “伪装者”问题是一个具有挑战性的问题
    • 引发假警报
  • 多分类
    • 每个用户的样本当作一个类别组成数据来源
    • 自身与他人
    • 用户加入/离开机构时需要重新训练
    • 伪装的非自身用户样本会偏离模型的审查
  • 单分类
    • 仅用该用户的数据,为本用户构建模型
    • 需要的数据少
    • 分布式实施

Schonlau 数据集

  • 来自70名用户的 Unix shell 命令
    • 使用 Unix acct 收集数据
    • 随机选择50名用户作为入侵目标
    • 20名伪装用户
  • 每个用户15000个命令
    • 持续数天或数月
    • 前5000个命令是正常的
    • 接下来的10000个命令,随机注入100个入侵块命令
    • 正常和入侵块的大小:100
  • 问题
    • 不同用户的时段差异很大
    • 每个用户的登录会话次数不同
    • 每个用户的入侵块数量不同(0-24)
    • 用户的工作职能未知
    • acct 按照命令完成的次序记录日志

机器学习方法

  • 学习任务
    • 明确的指认伪装者,而不是特定用户

朴素贝叶斯分类器

  • 贝叶斯定理
  • 不同的命令是独立的
  • 多变量伯努利模型
    • Unix 下856个唯一的命令
    • 每个块作为一个二进制的N维向量
    • 用伯努利建模每一个维度
    • 在小词汇量下表现更好
  • 多项式模型
    • 每个块作为N维向量
    • 每个命令出现的次数作为特征
    • 在大词汇量下表现更好
  • 单分类朴素贝叶斯
    • 仅使用用户自身的模型来计算\(p(c_i|u)\)
    • 对于伪装者,假定每个命令的概率都是\(1/N\)(完全随机)
      • 对伪装者不做假设
    • 给定一个块 \(d\),计算: \(p(d|{\rm self})/p(d|{\rm non-self})\)
    • 设定阈值控制误报与检测率

单分类 SVM

  • 将数据映射到高维特征空间
  • 最大化分离边界
  • 允许异常值,通过参数设置边缘出错的概率

局限性

  • 使用二值特征的单分类 SVM 表现的比单分类贝叶斯和使用数值特征的单分类 SVM 要好
  • 问题依旧困难,准确性有待提高
  • 2-gram 特征表现更差
  • 1-gram 和 2-grams 同时使用可能提高性能
  • 这个系统不应被用作唯一的检测器
  • 需要包含命令参数而不仅仅是命令本身

参考资料

  • One-class Training for Masquerade Detection (2003)
  • CS 259D Lecture 3

“CS 259D One-Class Training for Masquerade Detection”的104个回复

  1. I just want to say I’m all new to blogs and honestly loved your blog. Almost certainly I’m going to bookmark your website . You surely come with perfect writings. Regards for sharing with us your website page.

  2. HelloGreetingsHey thereHeyGood dayHowdyHi thereHello thereHi! This is my first visit to your blog! We are a groupcollectionteam of volunteers and starting a new initiativeproject in a community in the same niche. Your blog provided us valuableusefulbeneficial information to work on. You have done a marvellousoutstandingextraordinarywonderful job!

  3. Revise after nearly two years: Mattress is actually still keeping up fantastic. Wonderful buy for a mattress without awful chemicals. That is incredibly relaxed and also looks to be actually effectively made.

  4. Thanks for some other fantastic post. The place else may anyone get that type of info in such an ideal method of writing? I’ve a presentation next week, and I am on the search for such info.

  5. I loved as much as you will receive carried out right here. The sketch is tasteful, your authored subject matter stylish. nonetheless, you command get bought an nervousness over that you wish be delivering the following. unwell unquestionably come further formerly again since exactly the same nearly a lot often inside case you shield this increase.

  6. I’ve been surfing online more than three hours today, yet I never found any interesting article like yours. It is pretty worth enough for me. In my view, if all webmasters and bloggers made good content as you did, the web will be much more useful than ever before.

  7. Hiya very nice blog!! Man .. Excellent .. Amazing .. I will bookmark your site and take the feeds also…I am happy to search out a lot of helpful info right here within the submit, we need develop more techniques on this regard, thanks for sharing.

  8. Sweet blog! I found it while surfing around on Yahoo News. Do you have any suggestions on how to get listed in Yahoo News? I’ve been trying for a while but I never seem to get there! Thank you

  9. I as well as my guys ended up reading through the great helpful hints on your web page and suddenly I had a terrible suspicion I had not expressed respect to the site owner for those techniques. These boys appeared to be as a result stimulated to learn all of them and already have pretty much been having fun with those things. Appreciation for being simply thoughtful and for obtaining this kind of wonderful subjects millions of individuals are really wanting to discover. My honest apologies for not expressing gratitude to earlier.

  10. I was just seeking this information for a while. After six hours of continuous Googleing, finally I got it in your website. I wonder what is the lack of Google strategy that do not rank this type of informative sites in top of the list. Normally the top sites are full of garbage.

  11. I am also commenting to make you know what a impressive discovery my child encountered going through the blog. She even learned a wide variety of pieces, most notably how it is like to have a great teaching spirit to get many more clearly know specific hard to do subject matter. You really exceeded our expectations. Many thanks for providing these powerful, trusted, revealing and cool thoughts on that topic to Janet.

  12. Great post. I was checking constantly this blog and I’m impressed! Very helpful information specially the last part 🙂 I care for such information much. I was looking for this particular information for a long time. Thank you and good luck.

  13. Great – I should definitely pronounce, impressed with your website. I had no trouble navigating through all the tabs and related info ended up being truly simple to do to access. I recently found what I hoped for before you know it at all. Reasonably unusual. Is likely to appreciate it for those who add forums or something, web site theme . a tones way for your customer to communicate. Excellent task.

  14. I must show my love for your generosity supporting people that require guidance on this important idea. Your personal dedication to getting the solution throughout was really effective and have in most cases allowed workers like me to arrive at their goals. Your new warm and friendly guideline means this much a person like me and much more to my peers. Thank you; from everyone of us.

  15. Thanks a lot for sharing this with all of us you actually recognize what you are talking about! Bookmarked. Kindly additionally discuss with my website =). We will have a link change agreement among us!

  16. RETS PRO reviews and information are provided within our websites. RETSPRO serves a fabulous community of developers and real estate agents who require the ultimate flexibility of their RETS output. RETS PRO wordpress plugin is the absolute best software package available for any real estate property website developer. RETSPRO was built especially for web designers to allow them with the resources to fully customize a website for any real-estate clients.

  17. I like the valuable info you provide in your articles. I’ll bookmark your weblog and check again here frequently. I am quite certain I’ll learn plenty of new stuff right here! Best of luck for the next!

  18. Excellent read, I just passed this onto a colleague who was doing some research on that. And he just bought me lunch as I found it for him smile Thus let me rephrase that: Thank you for lunch! “Without friends no one would choose to live, though he had all other goods.” by Aristotle.

  19. I’m not sure where you are getting your information, but great topic. I needs to spend some time learning more or understanding more. Thanks for magnificent information I was looking for this info for my mission.

  20. Usually I don’t read article on blogs, however I would like to say that this write-up very forced me to try and do it! Your writing taste has been surprised me. Thank you, very great post.

  21. Good – I should certainly pronounce, impressed with your website. I had no trouble navigating through all tabs as well as related information ended up being truly simple to do to access. I recently found what I hoped for before you know it at all. Quite unusual. Is likely to appreciate it for those who add forums or something, web site theme . a tones way for your customer to communicate. Nice task.

  22. Wonderful beat ! I would like to apprentice while you amend your web site, how can i subscribe for a blog web site? The account aided me a acceptable deal. I had been a little bit acquainted of this your broadcast offered bright clear idea

  23. I’ve been browsing online greater than three hours lately, yet I by no means discovered any fascinating article like yours. It is beautiful price sufficient for me. Personally, if all webmasters and bloggers made excellent content material as you probably did, the web shall be a lot more helpful than ever before. “We are not retreating – we are advancing in another Direction.” by Douglas MacArthur.

  24. You actually make it seem so easy with your presentation but I find this matter to be actually something which I think I would never understand. It seems too complicated and very broad for me. I’m looking forward for your next post, I will try to get the hang of it!

  25. Hi, Neat post. There’s a problem along with your website in web explorer, would test this¡K IE still is the marketplace chief and a huge component to other folks will omit your wonderful writing due to this problem.

  26. Keep up the fantastic piece of work, I read few blog posts on this site and I conceive that your website is very interesting and holds circles of good info .

  27. If you are going for bestmost excellentfinest contents like meI domyself, onlysimplyjust visitgo to seepay a visitpay a quick visit this websiteweb sitesiteweb page everydaydailyevery dayall the time becausesinceasfor the reason that it providesoffersgivespresents qualityfeature contents, thanks

  28. Wow, incredible weblog layout! How lengthy have you ever been blogging for? you make running a blog glance easy. The whole glance of your website is fantastic, as smartly as the content material!

  29. Hiya, I’m really glad I’ve found this info. Nowadays bloggers publish only about gossips and web and this is really irritating. A good website with exciting content, this is what I need. Thank you for keeping this website, I will be visiting it. Do you do newsletters? Can’t find it.

  30. I’ve been surfing online more than 3 hours today, yet I never found any interesting article like yours. It’s pretty worth enough for me. In my view, if all website owners and bloggers made good content as you did, the web will be a lot more useful than ever before.

  31. I am not sure where you’re getting your info, but good topic. I needs to spend some time learning much more or understanding more. Thanks for fantastic information I was looking for this info for my mission.

  32. I am really impressed with your writing skills as well as with the layout on your blog. Is this a paid theme or did you customize it yourself? Anyway keep up the excellent quality writing, it’s rare to see a great blog like this one these days..

  33. I happen to be commenting to let you know what a extraordinary experience my friend’s girl had reading your site. She picked up some things, most notably what it’s like to have an excellent helping heart to let the others really easily know certain complex subject matter. You truly did more than our own expected results. Many thanks for rendering those useful, healthy, explanatory and fun tips on this topic to Mary.

  34. I intended to write you a very small observation to be able to give many thanks as before for these precious methods you have documented above. This is really unbelievably generous with you to give freely all a few people would have distributed as an electronic book to help with making some profit for their own end, notably since you might have tried it if you decided. These basics additionally worked to become fantastic way to recognize that someone else have a similar dream the same as mine to know a lot more regarding this condition. I know there are many more fun times ahead for individuals that start reading your website.

  35. Hi, Neat post. There’s an issue with your web site in internet explorer, could check this… IE nonetheless is the market chief and a big part of people will omit your fantastic writing because of this problem.

  36. I was suggested this web site by my cousin. I am not sure whether this post is written by him as no one else know such detailed about my problem. You’re incredible! Thanks!

  37. HiHello my family memberloved onefriend! I want towish to say that this articlepost is awesomeamazing, greatnice written and come withinclude almostapproximately all importantsignificantvital infos. I’dI would like to peerto seeto look moreextra posts like this .

  38. Excellent beat ! I would like to apprentice while you amend your site, how could i subscribe for a blog web site? The account helped me a acceptable deal. I had been a little bit acquainted of this your broadcast provided bright clear idea

  39. hi!,I like your writing so so much! share we keep in touch more approximately your article on AOL? I need an expert in this house to resolve my problem. May be that is you! Having a look forward to look you.

  40. But wanna input on few general things, The website design and style is perfect, the articles is very superb. “If a man does his best, what else is there” by George Smith Patton, Jr..

  41. hello!,I really like your writing so so much! percentage we keep up a correspondence extra approximately your post on AOL? I need an expert in this house to resolve my problem. Maybe that is you! Looking ahead to look you.

  42. I have been surfing online more than three hours today, yet I never found any interesting article like yours. It’s pretty worth enough for me. In my opinion, if all web owners and bloggers made good content as you did, the internet will be a lot more useful than ever before.

  43. I loved as much as you’ll receive carried out right here. The sketch is tasteful, your authored subject matter stylish. nonetheless, you command get got an edginess over that you wish be delivering the following. unwell unquestionably come more formerly again as exactly the same nearly very often inside case you shield this increase.

  44. I have been browsing on-line more than three hours today, but I by no means found any interesting article like yours. It is lovely value enough for me. In my opinion, if all website owners and bloggers made good content as you did, the net might be a lot more useful than ever before. “Oh, that way madness lies let me shun that.” by William Shakespeare.

  45. hello!,I really like your writing very a lot! proportion we keep in touch more approximately your article on AOL? I need an expert on this space to solve my problem. Maybe that’s you! Having a look forward to peer you.

  46. A person essentially assist to make severely articles I might state. That is the first time I frequented your website page and to this point? I amazed with the analysis you made to create this particular post extraordinary. Wonderful job!

  47. I¡¦m no longer sure the place you’re getting your info, however good topic. I must spend some time finding out more or figuring out more. Thanks for excellent info I was in search of this information for my mission.

  48. I have recently started a blog, the information you offer on this web site has helped me greatly. Thank you for all of your time & work. “The man who fights for his fellow-man is a better man than the one who fights for himself.” by Clarence Darrow.

  49. I do agree with all the ideas you’ve presented in your post. They are very convincing and will definitely work. Still, the posts are very quick for newbies. Could you please lengthen them a little from subsequent time? Thanks for the post.

  50. Unquestionably believe that which you said. Your favorite reason seemed to be on the web the easiest thing to be aware of. I say to you, I definitely get irked while people think about worries that they just do not know about. You managed to hit the nail upon the top and defined out the whole thing without having side effect , people can take a signal. Will likely be back to get more. Thanks

  51. I have recently started a web site, the information you provide on this web site has helped me tremendously. Thank you for all of your time & work. “The more sand that has escaped from the hourglass of our life, the clearer we should see through it.” by Jean Paul.

  52. Hello There. I found your blog using msn. This is an extremely well written article. I’ll be sure to bookmark it and return to read more of your useful information. Thanks for the post. I will certainly comeback.

发表评论

电子邮件地址不会被公开。 必填项已用*标注